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Minor Informalities 

1. The Applicant is required to submit a clean copy of the claims, because the claims 
submitted 1 1/17/2005 contain a Hne through the claims. Substitute claims are required. 

Claim Rejections - 35 USC § 112 

2. The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact tenns as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

3. Claims 13-20 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply with 
the enablement requirement. The claim(s) contains subject matter, which was not described in 
the specification in such a way as to enable one skilled in the art to which it pertains, or with 
which it is most nearly connected, to make and/or use the invention. More specifically claims 
17-18, which depend fi-om claim 13, are rejected under 112 1'^ for the limitations of "key 
repository is configured to provide access to the second key in response to receiving a threshold 
number of valid passwords, each password associated with a different user fi-om the second 
group of users". In the specification on page 15 lines 10-17, there is not disclosed, "key 
repository is configured to provide access to the second key in response to receiving a threshold 
number of valid passwords, each password associated with a different user fi:*om the second 
group of users". On page 15 there is a disclosed an integrity key that is used to protect the 
database and a protection key used to protect the data in the database. There is a disclosed what 
makes up the integrity key and protection key; however there is not disclosed "key repository is 
configured to provide access to the second key in response to receiving a threshold number of 
valid passwords, each password associated with a different user from the second group of users". 
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4. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter, which the applicant regards as his invention. 

5. Claims 13-20 are rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for 
failing to particularly point out and distinctly claim the subject matter which applicant regards as 
the invention. More specifically claims 17-18, which depend on claim 13, are rejected under 112 
2^^^ for claiming new matter. Claim 17, claims, "key repository is configured to provide access to 
the second key in response to receiving a threshold number of valid passwords, each password 
associated with a different user from the second group of users". There is not disclosed, "key 
repository is configured to provide access to the second key in response to receiving a threshold 
number of valid passwords, each password associated with a different user from the second 
group of users". On page 29 lines 1-20 of the specification, disclosed each owner key is 
constructed and split using Bloom-Shamir. Claims 17 contain new matter that will not be 
examined, because it is not disclosed in the specification. 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

7. Claims 1-12, 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over Van 
Oorschot(6,3 17,829) in view of Eastlake and further in view of Okamoto et al(6,l 18,874). 
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8. As per claims 1,11,21, Van Oorschot discloses a cryptographic keys used during 
operation of a computer system(see col. 3, lines 20-24), providing an old set of cryptographic 
keys(see col. 6, lines 21-32, col 7, lines 3-14); including at least a first cryptographic key 
protects an integrity of secret information stored in a database(see col. 6, lines 33-47), and the 
second cryptographic key protects access to the secret information stored in the database(see col. 
4, lines 52-58, col. 7, lines 30-41), checking with a key repository to determine if a certificate re- 
issuance is necessary, meanwhile maintaining the availability of the old set of cryptographic 
keys(see col. 6, lines 22-32, col. 7, lines 3-14); the new keys are stored in the database(see col. 4, 
lines 24-48, col. 7, lines 6-11), providing the new or revised keys to appHcations that need them 
when next requested by such appHcations(see col. 3, lines 30-39, col 6, lines 22-32). Van 
Oorschot discloses an application, because the primary computing unit, and the server 
communicated the key history information via a intemet link(see col. 5, lines 3-6), an application 
is inherent in Van Oorschot, because Van Oorschot discloses communicating the key 
information to the primary computing device via an Intemet link, this link has an application, 
such as a web browser. However, Van Oorschot does not disclose key rollover. Eastlake does 
disclose key rollover. 

9. It would have been obvious to one of ordinary skill in the art at the time of the invention 
to combine Van Oorschot with Eastlake to include key rollover, one would have been motivated 
to include key rollover of Eastlake, because in order to obtain high levels of security, keys must 
be periodically changed, or "rolled over"(see pg. 3 of Eastlake). Rollover is necessary because 
the longer a private key is used the more likely it is to be compromised due to cryptanalysis, 
accident or treachery(see pg. 3 of Eastlake). 
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10. Neither Oorschot nor Eastlake disclose wherein the applications detect a missing key, and 
check with the key repository for the missing key, and if the missing key has been reissued, the 
applications receive the reissued key. Okamoto discloses wherein the appHcations detect a 
missing key, and check with the key repository for the missing key, and if the missing key has 
been reissued, the apphcations receive the reissued key(see fig., 8, sheet 9, and associated 
descriptions). It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine Van Oorschot-Eastlake combination with Okamoto to include wherein the 
appHcations detect a missing key, and check with the key repository for the missing key, and if 
the missing key has been reissued, the applications receive the reissued key, one would have 
been motivated because there is the possibility that secret information cannot be recovered 
because of a key being lost or the owner of a key becoming unavailable(see col. 2, lines 28-31 of 
Okamoto). It is an economical loss whenever the secret information that cannot be recovered is 
used in the activity of an enterprise(see col. 2, lines 31-33). One effective approach is to provide 
a key recovery system in which a copy of a key is backed up so that the key can be recovered(see 
col 2, lines 33-36 of Okamoto). 

11. As per claim 2, Van Oorschot discloses key repository utilizing one or more services of a 
specialized application acting as an extension of the key repository (col. 3, lines 27-39, col. 6, 
lines 22-32). 

12. As per claim 3, Van Oorschot discloses the key repository utilizes the one or more 
services of the specialized application, authenticating authorization of the specialized appHcation 
to perform one or more services(see col. 3, lines 27-39, 51-67, col. 7, lines 30-53). 
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13. As per claim 4, Van Oorschot discloses a command that when the key is about to 
approach expiration, a new key is issued(see col. 6, lines 22-32). Van Oorschot does not disclose 
invoking the command. Eastlake discloses invoking a key rollover. The motivation to include 
invoking the key rollover, is that being invoked as a result of a command, is the longer a private 
key is used, the more likely it is to be compromised due to cryptanalysis, accident or 
treachery(see pg. 3 of Eastlake). 

14. As per claim 5, Van Oorschot discloses a periodic check which senses that the old set of 
cryptographic keys are approaching expiration (see col 4, lines 24-47, col. 6, lines 21-32). 

15. As per claim 6, Van Oorschot discloses a result of sensing an expired key(see col. 4, lines 
24-47, col 6, lines 21-32). 

16. As per claim 7, Van Oorschot discloses wherein the appHcations are notified of the 
presence of new keys by the key repository process(see col. 8, lines 41-56). 

17. As per claim 9, Van Oorschot discloses wherein the key repository process is prompted 
by the applications to invoke the method as a result of the applications detecting a key 
approaching expiration (see col 6, lines 62-67, col. 7, lines 1-11). 

18. As per claim 10, Van Oorschot discloses wherein the applications request the key 
repository process to provide a new key as a result of applications detecting an expired key(see 
col. 7, lines 1-14). 

19. As per claim 1 1, Van Oorschot discloses a key repository configured to maintain at least 
a first key and second key(see fig. 1, sheet 1), and a database coupled to the key repository(see 
fig. 1, sheet 1), and storing secret information wherein the first key protects an integrity of the 
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secret information stored in the database(see col. 6, lines 33-49), and the second key protects 
access to the secret information stored in the database(see col. 4, lines 52-58, col. 7, lines 30-41). 

20. As per claim 12, Van Oorschot discloses at least one application that can access the key 
repository, wherein the at least one apphcation is preauthorized to access the second key and can 
perform at least one function using the secret information without user intervention(see col. 5, 
lines 64-67, col. 6, lines 1-7). 

21. As per claim 21, limitations have already been addressed(see claim 1, and 1 1). 

22. Claims 13-20 are rejected under 112 V\ because the claimed limitations are not described 
in the specification. 

Response to Amendment 

21. As per claims 8, and 21, previously indicated as allowable, has been withdrawn. The 
Examiner has found art to reject the limitations of these claims. 

22. The Examiner also rejected claims 13-20 under 112 The Applicant provided citations 
in the specification were the claim limitations were found. However, the Examiner still does not 
see how claim 17 is taught in the specification. The Examiner read the citations provided, but 
still does not see the claim limitations taught. Therefore, the rejection under 112 1^^ still stands, 
and further claim 17 is rejected under 1 12 2"^(see above for remarks). 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jenise E. Jackson whose telephone number is (571) 272-3791. 
The examiner can normally be reached on M-Th (6:00 a.m. - 3:30 p.m.) alternate Friday's. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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